deb (file format)

deb (file format)
Name	deb
Extension	.deb
Mime	application/vnd.debian.binary-package
Owner	Debian Project
Type	Package format
Released	1994
Genre	Software packaging

deb (file format)

deb is a software package format used for installing, distributing, and managing software on systems derived from Debian and Ubuntu. It encapsulates binary data, metadata, and control scripts to enable package management by tools such as dpkg, apt, and aptitude. Developers, maintainers, and system administrators across projects like Kali Linux, Raspbian, and Linux Mint rely on this format for reproducible deployment and upgrades.

Overview

The format originated within the Debian Project and is integral to package ecosystems including Ubuntu, Linux Mint, Kali Linux, Raspbian, elementary OS, Devuan, and distributions built by organizations like Canonical (company), Google for internal projects, and community efforts aligned with OpenStack deployments. It interoperates with tools such as dpkg, apt-get, aptitude, apt, and frontends like Synaptic Package Manager, supporting repositories hosted on services used by GitHub, SourceForge, and mirrors coordinated by the Debian Project infrastructure. Maintainers follow guidelines from the Debian Policy Manual and collaborate through channels such as Debian mailing lists, Debian Developer teams, and conferences like DebConf.

File structure

A package in this format is an ar archive containing at minimum a debian-binary file, a control archive, and a data archive; implementations often interact with tools like ar, tar, and compression utilities common to GNU toolchains. The control archive contains metadata used by dpkg and repository tools like aptly and reprepro, while the data archive holds payload files applied to filesystem trees used by distributions such as Debian and Ubuntu. Utilities from projects like GNU coreutils, BusyBox, and perl-based helpers often manipulate package payloads during build or installation invoked by maintainers listed in maintainer scripts and policies enforced by the Debian Policy Manual.

Package metadata and control files

Control data includes fields defined in the Debian Policy Manual such as Package, Version, Architecture, Depends, Provides, Conflicts, Replaces, and Maintainer, referenced by tools like dpkg, apt, apt-cache, and dpkg-query. The control archive also contains maintainer scripts—preinst, postinst, prerm, postrm—interpreted by shells such as Bash or Dash during lifecycle hooks used by projects like systemd-based services or sysvinit transitions. Metadata interacts with repository metadata generators like dpkg-scanpackages, apt-ftparchive, and mirror sync tools used by Ubuntu Archive and Debian Archive infrastructures, enabling index generation for clients including apt-get and graphical frontends like Gnome Software.

Compression and archive formats

Data and control archives are usually tarballs compressed with algorithms supported by gzip, bzip2, xz, or zstd; historically, gzip and bzip2 were common, while newer practice favors xz and zstd for better compression ratios used in distributions like Debian, Ubuntu, and Arch Linux (when packaging with different formats). The outer ar container conforms to implementations from GNU binutils and interoperability is tested with tools like file and tar across platforms including FreeBSD and NetBSD when cross-distribution packaging or conversion tools are required. Build tools such as dpkg-deb, debuild, pbuilder, and sbuild handle compression choices during package creation in automation pipelines integrated with CI systems like Jenkins, GitLab CI, and Travis CI.

Installation, management, and tools

Installation is performed by dpkg which updates the package database in /var/lib/dpkg and interacts with higher-level resolvers like apt and aptitude to satisfy dependencies using repositories hosted by Debian Project mirrors and third-party providers. Graphical installers and managers include Synaptic Package Manager, Gnome Software, and KDE Discover; server-side automation uses tools such as Ansible, Puppet, Chef, and SaltStack to deploy packages across fleets managed by organizations like Canonical (company) or academic clusters at institutions such as CERN and MIT. Build and signing helpers include pbuilder, sbuild, dpkg-buildpackage, and packaging utilities used by contributors in teams like Debian Maintainers and Ubuntu Developers.

Security and signing

Package authenticity is commonly ensured by signing repository metadata with GnuPG keys managed by teams such as the Debian Project archive admins and Ubuntu Archive maintainers; clients verify signatures via apt using gpgv or integrated cryptographic routines. Individual .deb files can be examined with tools like dpkg-sig or validated by verifying control checksums and compares against policies enforced by Debian Security teams and incident responders from organizations including CERT coordination centers. Vulnerability tracking for packages uses databases and services such as CVE, US-CERT, NVD, and vendor advisories from entities like Canonical (company) and upstream maintainers.

History and variants

The format was introduced in the early 1990s within the context of Debian development and evolved through contributions from developers associated with projects and institutions like Ian Murdock's efforts, Bruce Perens, and the broader community that established the Debian Policy Manual; variants and related formats include source package formats like orig/ diff/ dsc conventions and alternative binary packaging systems such as RPM Package Manager used by Red Hat, Fedora, CentOS, and conversions via tools like alien. Distributions and derivative projects including Ubuntu, Linux Mint, Kali Linux, and Raspbian have extended workflows, while research institutions and companies integrate the format into continuous delivery pipelines using CI systems such as Jenkins and GitLab CI.

Category:Debian